php序列化serialize() 与反序列化unserialize()

$stooges = array('Moe','Larry','Curly');
$new = serialize($stooges);
print_r($new);
echo "<br />";
print_r(unserialize($new));

结果：
a:3:{i:0;s:3:"Moe";i:1;s:5:"Larry";i:2;s:5:"Curly";}
Array ( [0] => Moe [1] => Larry [2] => Curly )

$shopping = array('Poppy seed bagel' => 2,'Plain Bagel' =>1,'Lox' =>4);

echo '<a href="next.php?cart='.urlencode(serialize($shopping)).'">next</a>';

$new_cart = unserialize(stripslashes($cart));

//如果magic_quotes_gpc开启
$new_cart = unserialize($cart);

$fp = fopen('/tmp/cart','w');

fputs($fp,addslashes(serialize($a)));

fclose($fp);

//如果magic_quotes_runtime开启
$new_cat = unserialize(stripslashes(file_get_contents('/tmp/cart')));

//如果magic_quotes_runtime关闭
$new_cat = unserialize(file_get_contents('/tmp/cart'));

mysql_query("insert into cart(id,data) values(1,'".addslashes(serialize($cart))."')");

$rs = mysql_query('select data from cart where id=1');

$ob = mysql_fetch_object($rs);

//如果magic_quotes_runtime开启
$new_cart = unserialize(stripslashes($ob->data));

//如果magic_quotes_runtime关闭
$new_cart = unserialize($ob->data);

<?php

//声明一个类

class dog {

var $name;

var $age;

var $owner;

function dog($in_name="unnamed",$in_age="0",$in_owner="unknown") {

$this->name = $in_name;

$this->age = $in_age;

$this->owner = $in_owner;

}

function getage() {

return ($this->age * 365);

}

function getowner() {

return ($this->owner);

}

function getname() {

return ($this->name);

}

}

//实例化这个类

$ourfirstdog = new dog("Rover",12,"Lisa and Graham");

//用serialize函数将这个实例转化为一个序列化的字符串

$dogdisc = serialize($ourfirstdog);

print $dogdisc; //$ourfirstdog 已经序列化为字符串 O:3:"dog":3:{s:4:"name";s:5:"Rover";s:3:"age";i:12;s:5:"owner";s:15:"Lisa and Graham";}

/*

-----------------------------------------------------------------------------------------

在这里你可以将字符串 $dogdisc 存储到任何地方如 session,cookie,数据库,php文件

-----------------------------------------------------------------------------------------

*/

//我们在此注销这个类

unset($ourfirstdog);

?>

b.php

<?php

?>

<?php

//声明一个类

class dog {

var $name;

var $age;

var $owner;

function dog($in_name="unnamed",$in_age="0",$in_owner="unknown") {

$this->name = $in_name;

$this->age = $in_age;

$this->owner = $in_owner;

}

function getage() {

return ($this->age * 365);

}

function getowner() {

return ($this->owner);

}

function getname() {

return ($this->name);

}

}

/*还原操作   */

/*

-----------------------------------------------------------------------------------------

在这里将字符串 $dogdisc 从你存储的地方读出来如 session,cookie,数据库,php文件

-----------------------------------------------------------------------------------------

*/

$dogdisc='O:3:"dog":3:{s:4:"name";s:5:"Rover";s:3:"age";i:12;s:5:"owner";s:15:"Lisa and Graham";}';

//我们在这里用 unserialize() 还原已经序列化的对象

$pet = unserialize($dogdisc); //此时的 $pet 已经是前面的 $ourfirstdog 对象了

//获得年龄和名字属性

$old = $pet->getage();

$name = $pet->getname();

//这个类此时无需实例化可以继续使用,而且属性和值都是保持在序列化之前的状态

print "Our first dog is called $name and is $old days old<br>";

?>

static inline void php_var_serialize_string(smart_str *buf, char *str, int len) /* {{{ */
  {
smart_str_appendl(buf, "s:", 2);
smart_str_append_long(buf, len);
smart_str_appendl(buf, ":＼"", 2);
smart_str_appendl(buf, str, len);
smart_str_appendl(buf, "＼";", 2);
  }

switch (yych) {
  ...
case 's':  goto yy9;
...
  yy9:
yych = *(YYMARKER = ++YYCURSOR);
if (yych == ':') goto yy46;
goto yy3;
...
  yy46:
yych = *++YYCURSOR;
if (yych == '+') goto yy47;
if (yych <= '/') goto yy18;
if (yych <= '9') goto yy48;
goto yy18;
  yy47:
yych = *++YYCURSOR;
if (yych <= '/') goto yy18;
if (yych >= ':') goto yy18;
  yy48:
++YYCURSOR;
if ((YYLIMIT - YYCURSOR) < 2) YYFILL(2);
yych = *YYCURSOR;
if (yych <= '/') goto yy18;
if (yych <= '9') goto yy48;
if (yych >= ';') goto yy18;
yych = *++YYCURSOR;
if (yych != '"') goto yy18;
++YYCURSOR;
{
size_t len, maxlen;
char *str;
 
len = parse_uiv(start + 2);
maxlen = max - YYCURSOR;
if (maxlen < len) {
  *p = start + 2;
  return 0;
}
 
str = (char*)YYCURSOR;
 
YYCURSOR += len;
 
if (*(YYCURSOR) != '"') {
  *p = YYCURSOR;
  return 0;
}
  // 确保格式为 s:x:"x"
 
YYCURSOR += 2;
*p = YYCURSOR;
  // 注意这里，*p 指针直接后移了两位，也就是说没有判断 " 后面是否为 ;
 
INIT_PZVAL(*rval);
ZVAL_STRINGL(*rval, str, len, 1);
return 1;

static char *unserialize_str(const unsigned char **p, size_t *len, size_t maxlen)
  {
size_t i, j;
char *str = safe_emalloc(*len, 1, 1);
unsigned char *end = *(unsigned char **)p+maxlen;
 
if (end < *p) {
  efree(str);
  return NULL;
}
 
for (i = 0; i < *len; i++) {
  if (*p >= end) {
efree(str);
return NULL;
  }
  if (**p != '＼＼') {
str[i] = (char)**p;
  } else {
unsigned char ch = 0;
 
for (j = 0; j < 2; j++) {
  (*p)++;
  if (**p >= '0' && **p <= '9') {
ch = (ch << 4) + (**p -'0');
  } else if (**p >= 'a' && **p <= 'f') {
ch = (ch << 4) + (**p -'a'+10);
  } else if (**p >= 'A' && **p <= 'F') {
ch = (ch << 4) + (**p -'A'+10);
  } else {
efree(str);
return NULL;
  }
}
str[i] = (char)ch;
  }
  (*p)++;
}
str[i] = 0;
*len = i;
return str;
  }
  // 上面的函数是对 ＼72＼79＼61＼74＼73＼79＼6e＼65 这样十六进制形式字符串进行转换
  ...
  switch (yych) {
...
case 'S':  goto yy10;
// 处理过程与 s: 相同
if ((str = unserialize_str(&YYCURSOR, &len, maxlen)) == NULL) {
  return 0;
}
// 处理过程与 s: 相同

$str1 = 's:8:"ryatsyne";';
  $str2 = 's:8:"ryatsyne"t';
  $str3 = 'S:8:"＼72＼79＼61＼74＼73＼79＼6e＼65"';
  var_dump(unserialize($str));
  // $str1, $str2 and $str3 unserialized string output
  // ryatsyne;

* mixed safe_unserialize(string $serialized)
* Safely unserialize, that is only unserialize string, numbers and arrays, not objects
*
* @license Public Domain
* @author dcz (at) phpbb-seo (dot) com
*/
static public function safeUnserialize( $serialized )
{
// unserialize will return false for object declared with small cap o
// as well as if there is any ws between O and :
if ( is_string( $serialized ) && strpos( $serialized, "＼0" ) === false )
{
if ( strpos( $serialized, 'O:' ) === false )
{
// the easy case, nothing to worry about
// let unserialize do the job
return @unserialize( $serialized );
}
else if ( ! preg_match('/(^|;|{|})O:[+＼-0-9]+:"/', $serialized ) )
{
// in case we did have a string with O: in it,
// but it was not a true serialized object
return @unserialize( $serialized );
}
}

return false;
}
 
// a:1:{s:8:"ryatsyne"tO:8:"ryatsyne":0:{}}
// 只要构造类似的序列化字符串就可以轻易突破这里的过滤了

<?php
ob_start();
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "http://www.xxx.cn/test/test2.php");
curl_setopt($ch, CURLOPT_HTTPHEADER, array('X-FORWARDED-FOR:1.1.1.1', 'CLIENT-IP:2.2.2.2'));  //伪造IP
curl_setopt($ch, CURLOPT_REFERER, "http://www.111cn.net/ ");   //伪造来源网址
curl_setopt($ch, CURLOPT_HEADER, 1);
curl_exec($ch);
curl_close($ch);

$out = ob_get_contents();
ob_clean();
echo $out;

?>

<?php
function getClientIp() {
if (!empty($_SERVER["HTTP_CLIENT_IP"]))
$ip = $_SERVER["HTTP_CLIENT_IP"];
else if (!empty($_SERVER["HTTP_X_FORWARDED_FOR"]))
$ip = $_SERVER["HTTP_X_FORWARDED_FOR"];
else if (!empty($_SERVER["REMOTE_ADDR"]))
$ip = $_SERVER["REMOTE_ADDR"];
else
$ip = "err";
return $ip;
}

echo "<br />IP: " . getClientIp() . "  HTTP_CLIENT_IP-: " . $_SERVER["HTTP_CLIENT_IP"] . "    HTTP_X_FORWARDED_FOR-: " . $_SERVER["HTTP_X_FORWARDED_FOR"] . "    REMOTE_ADDR-: " . $_SERVER["REMOTE_ADDR"] . "   ";
echo "<br />referer: " . $_SERVER["HTTP_REFERER"];
?>

<?php

$str='a:2:{s:5:"title";s:13:"php教程分享网";s:3:"url";s:20:"http://www.111cn.net";}';
$regex = '/s＼:(＼d+)＼:＼"([^＼"]+)＼"/isx';

$str = preg_replace_callback(

$regex ,

"fixser",

$str);

function fixser($matches)

{

 return 's:'.strlen($matches[2]).':'.'"'.$matches[2].'"';

}

?>

<?php
$str='a:2:{s:5:"title";s:13:"php教程分享网";s:3:"url";s:20:"http://www.111cn.net";}';
$regex = '/s＼:(＼d+)＼:＼"([^＼"]+)＼"/isx';

$str = preg_replace_callback(
$regex ,
function ($matches)
{
 return 's:'.strlen($matches[2]).':'.'"'.$matches[2].'"';
},
$str);

?>

header("Content-type:text/html;charset=utf-8");
//单例测试类
class Test {
    private $unique;
    static private $instance;//静态属性保存该类实例
     
    private function __construct(){//构造方法私有(防止外界调用)
        $this->unique=rand(0,20000);
    }
    static public function getInstance(){//静态方法提供对外接口(获取实例)
        if(!self::$instance instanceof self){
            self::$instance=new self();
        }
        return self::$instance;
    }
    private function __clone(){}//私有克隆方法,防止外界直接克隆该实例
    
}
$test=Test::getInstance();
$test2=Test::getInstance();
    
print_r($test);
print_r($test2);
    
if($test===$test2){
    echo '相等!';
}else{
    echo '不相等!';
}

<?php
//数据库类、单例模式
class db{
public $conn;
private  static $sql;
private static $instact = null;

private function __construct(){
require_once('db.config.php');
$this->conn = mysql_connect($db['host'],$db['user'],$db['psd']);
if(!mysql_select_db($db['databases'],$this->conn)){
echo "数据库连接错误";
}
mysql_query('set names utf8',$this->conn);
}

public static function getInstance(){
if(is_null(self::$instact)){
self::$instact = new  db;
}
return self::$instact;
}
/**
*数据查询
*/
public function select($table,$condition=array(),$field=array()){
$where ="";
if(!empty($condition)){
foreach($condition as $k=>$v){
$where.= $k."='".$v."' and ";
}
$where = "where ".$where." 1=1";
}
if(!empty($field)){
foreach($field as $k=>$v){
$fieldstr.= $v.",";
}
$fieldstr = rtrim($fieldstr);
}else{
$fieldstr = "*";
}
self::$sql = "select {$fieldstr} from {$table} {$where}";
$result =  mysql_query(self::$sql);
$i = 0;
while($row = mysql_fetch_assoc($result)){
foreach($row as $k=>$v){
$resultrow[$i][$k] = $v;
}
$i++;
}
var_dump($resultrow);
}

/**
*数据添加
*/
public function insert($table,$data){
$values = "";
$datas = "";
foreach ($data as $k=>$v){
$values.=$k.",";
$datas.="'$v'".",";
}
$values = rtrim($values,',');
$datas = rtrim($datas,',');
self::$sql = "insert into {$table}({$values}) values ({$datas})";
if(mysql_query(self::$sql)){
return mysql_insert_id();
}else{
return false;
};
}

/**
*数据更新
*/
public function update($table,$data,$condition=array()){
$where = "";
if(!empty($condition)){
foreach ($condition as $k=>$v){
$where.= $k."=".$v." and ";
}
$where="where ".$where."1=1";
}
$updatastr = "";
if(!empty($data)){
foreach($data as $k=>$v){
$updatastr.= $k."='".$v."',";
}
$updatastr= "set ".rtrim($updatastr,",");
}
self::$sql = "update {$table} {$updatastr} {$where}";
return mysql_query(self::$sql);
}
/**
*数据 删除
*/
public function delete($table,$condition){
$where = "";
if(!empty($condition)){
foreach( $condition as $k=>$v){
$where.=$k."='".$v."' and ";
}
$where = "where ".$where.'1=1';
}
self::$sql = "delete from {$table}  {$where}";
return mysql_query(self::$sql);
}
//打印sql
public function getlastsql(){
echo self::$sql;
}
}
$ne = db::getInstance();
//$ne->update('message',array('user'=>'wanghao','title'=>'sd'),array('id'=>'5'));
//echo $db->insert('message',array('user'=>'张三','title'=>'demo'));
$ne->select('message',array('user'=>'songlin'));
$ne->getlastsql();
?>

数据库的配置文件

db.config.php

<?php
$host = "localhost";  //主机地址
$user = "root";         //用户名
$psd= "";                 //密码
$databases = "ceshi";

$db = array( "host" =>$host,
"user" =>$user,
"psd" =>$psd,
"databases"=>$databases
);
?>

#############a域名ApiController.php #################
 /*
  * 根据当前域（a域名）的cookie信息设置bstv域下的cookie及session
  * 如果为空，则清空处理
  * */
 function setckAction() {
  $clr = $this->_request->getParam("clr");
  $bts_user = ($clr) ? '' : urlencode($_COOKIE['bts_LOGGED_USER']);
  $this->view->assign("bts_user",$bts_user);
 }
 
 /*
  * 提供给bstv域下，获取当前域（a域名）的cookie及session
  * 以脚本变量返回给bstv浏览器端
  * */
 function getckAction() {
  header('P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"');
  echo 'var ck="'.$_COOKIE['bts_LOGGED_USER'].'";';
  echo 'var sess="'.$_SESSION['user']['uid'].'";';
  exit();
 }
#############a域名index.php #################
##### 默认指定index.php为登录返回的页面
<script src="http://www.B域名/api/setck?bts_user={$bts_user}"></script>
############# B域名 api.php #################
 
 /*
  * 显示a域名域下的cookie及SESSION
  * 赋值到js变量
  * js 通过ajax写入cookie和session：如果a域名已退出，则bstv做退出处理
  * */
 function getbtsck() {
  include $this->template->getfile('api/getbtsck');
 }
 
 /*
  * a域名域下设置bstv域下的cookie及session
  * 如果为空，则清空处理
  * */
 function setck() {
  header('P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"');
 
  $bts_user = trim($_GET['bts_user']);
  if(!empty($bts_user)) {
   setcookie("bts_LOGGED_USER", urldecode($bts_user), time()+3600*24*365, "/", ".B域名");
   $this->cookieLoginLocal(urldecode($bts_user));
  } else {
   setcookie("bts_LOGGED_USER", $bts_user, '-1', "/", ".B域名");
   unset($_SESSION['uid']);
  }
 }
 
 function setsession() {
  $bts_user = trim($_POST['bts_user']);
  if(!empty($bts_user) && empty($_SESSION['uid'])) {
   setcookie("bts_LOGGED_USER", urldecode($bts_user), time()+3600*24*365, "/", ".B域名");
   $this->cookieLoginLocal(urldecode($bts_user));
  } else {
   echo 'uuunset';
   setcookie("bts_LOGGED_USER", $bts_user, '-1', "/", ".B域名");
   //unset($_SESSION['uid']);
  }
 }
 
 function cookieLoginLocal($cookieId){
  $cookieId = explode( '.', base64_decode($cookieId) );
  if ($cookieId[0] !== 'baitianshi' || empty($cookieId[1])) {
   return false;
  } else {
   return $this->loginLocal($cookieId[1],false,1);
  }
 }
 
 function loginLocal($uid,$password=false,$isuid=0) {
  $_SESSION['uid'] = $uid;
  return 1;
 }

############# B域名 getbtsck.html #################
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
 <meta http-equiv="Content-Type" content="text/html;charset=UTF-8" />
 <title>同步登陆</title>
 <script src="/js/jquery-1.8.1.min.js" type="text/javascript"></script>
    <script src="/api/getck"></script>
 <script language="javascript">
 function setck(bts_user) {
  $.post("/api/setsession",{bts_user:bts_user},function(re){ });}
  setck(ck);
    </script>
</head>
<body>
</body>
</html>